e9aa7a3bee8d81f760716947e4335c9cef69bf82e0035183b14ed30183379d89

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 10:01

Target

2be95249de1ea5acfff7a25d1fa40d38_JaffaCakes118.dll
Size

24KB
MD5

2be95249de1ea5acfff7a25d1fa40d38
SHA1

0c825d6e3e70b46429fb889f2e115b513525ebec
SHA256

e9aa7a3bee8d81f760716947e4335c9cef69bf82e0035183b14ed30183379d89
SHA512

16a4998eb29173009fa1502bded39bd791f17849f88b97d9e2e34f856810899d060186d9f1eeb1b18e82e15795725a6050e2e00d914464b98b7304999a4f7709
SSDEEP

384:efJQ5b433eUMW8a3AF2d/Q7j2u4tkWXpct5C3:efJvZD3Aq+zIkAat5C3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1076	2632	rundll32.exe	30
PID 2632 wrote to memory of 1076	2632	rundll32.exe	30
PID 2632 wrote to memory of 1076	2632	rundll32.exe	30
PID 2632 wrote to memory of 1076	2632	rundll32.exe	30
PID 2632 wrote to memory of 1076	2632	rundll32.exe	30
PID 2632 wrote to memory of 1076	2632	rundll32.exe	30
PID 2632 wrote to memory of 1076	2632	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2be95249de1ea5acfff7a25d1fa40d38_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2be95249de1ea5acfff7a25d1fa40d38_JaffaCakes118.dll,#1
  2⤵
  PID:1076